luna/enodia-sentinal
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Add event-driven memory syscall telemetry

Browse source
This commit is contained in:
Luna 2026-06-13 05:45:30 -07:00
parent 893409b549
commit a51478fa22
18 changed files with 589 additions and 32 deletions
Download patch file Download diff file Expand all files Collapse all files

9
tests/test_web.py
View file

@ -68,6 +68,15 @@ class TestDataLayer(unittest.TestCase):
(self.tmp / "events.log").write_text("l1\nl2\nl3\n")
self.assertEqual(web.tail_events(self.cfg, 2), ["l2", "l3"])
def test_status_reports_exec_and_syscall_ebpf(self):
(self.tmp / "events.log").write_text(
"2026 eBPF exec monitor: enabled\n"
"2026 eBPF syscall monitor: disabled (not running as root)\n"
)
st = web.daemon_status(self.cfg)
self.assertEqual(st["ebpf_exec"], "enabled")
self.assertEqual(st["ebpf_syscall"], "disabled (not running as root)")
def test_incident_and_response_plan_data(self):
_write_alert(self.tmp, "alert-20260531-000001", "CRITICAL", ["reverse_shell"])
iid = incident.record(self.cfg, "alert-20260531-000001.log",